I like this idea and have been wondering about it. Right now it is considered normal for every company to keep personal data, but what if it was forbidden to s

I like this idea and have been wondering about it. Right now it is considered normal for every company to keep personal data, but what if it was forbidden to store anything for longer than say 10 minutes and it is only allowed to keep anything in random access memory, not persistent storage? What if the person dealing with a company could generate a random identifier to allow for time-limited access to their data through a standard API? What if the companies/organizations were by law required to ONLY access personal data through that API with all access being logged and auditable by the individual? If during an audit code (due to reasonable suspicion) it is found that the company is storing the data instead of reading and forgetting immediately, the company would face heavy fines. Would this be enough? Probably not to deter bad actors... Maybe companies should not have access to any personal data in the first place? Only post office/delivery company would need to know where the mail for temporary ID must be delivered to. Same with phone numbers, they don't need them. Only phone companies need to be able to resolve the temporary ID to make a call. It would FINALLY deal with the spam even though I guess phone companies are skimming money off that, so they won't be too happy if the legislation required it. Exceptions can be made, but if there are fewer exceptions, the data would be far more tightly controlled.